can we monitor Port monitoring and B2BUA service from prognosis?

[kashyap]

Hello All,

I need some information that can B2BUA service and Port monitoring can be monitored by prognosis for cisco expressway?

Thanks,

Kashyap.

[Scott_Clement · Accepted solution]

Hi @kashyap,

There don't appear to be any alerts that are specific to the B2BUA service or the ports it's using (out-of-the-box), but you may be able to leverage a couple of Expressway records for this purpose. 

The CiscoExpresswaySnmpHostSoftwareRunningPerformance record (short name= CEWHSTRP) is based on HOST-RESOURCES-MIB:hrSWRunPerf and this may provide you with perf metrics to monitor the performance (if you can identify the related process). I don't see anything that would provide the status of the service (to alert if it were to stop).

The CiscoExpresswaySnmpRFC1213MIBTcpConnection record (short name= CEWTCPCO) provides TCP connection information from the RFC1213-MIB and you may be able to use this to identify if the B2BUA service has an open listener or connections established over the ports this service is using.

If the out-of-box solution doesn't satisfy your requirements, the other alternatives you might consider are either:

• A custom built solution that would be delivered by our professional services team
• Submiting a request to our product team to consider as a future enhancement.

Your account representative would be able to help you with either of these options.

I hope this helps!

Regards,

Scott Clement

[kashyap]

Hi Scot,

Thanks for the detailed information.

I had one small doubt regarding ports if you can see the below snapshots we see that prognosis is having all the data related to ports and in that  port 5071 is showing listen and in another port 5071 is showing established i marked them in yellow, can you tell me what do they mean as you said the we won't able to capture port alerts in prognosis.

Thanks,

Kashyap.

[Scott_Clement · Accepted solution]

Hi @kashyap,

A TCP listener is usually established when a process or service binds to a port in order to listen for inbound (or in some cases, local) connections. In the case of UDP, you'll only ever see a listener established (because it's connection-less) and these types of listeners will receive any packets sent to that port (some exmaples of this would be SNMP or RTCP).

In the example you've highlighted, it's using an IP of 0.0.0.0, which indicates it's not bound to a specific interface, it's  listenting on all available interfaces.

When an inbound TCP connection is made to that port, then you'll see an additional entry with the same local port number, but you'll also see the local IP address of the interface the connection was made to, along with the remote IP address and remote port of the system making that connection.

This information is similar to what you would see when running the netstat command via the Windows Command shell (e.g. 'netstat  -an').

In this case, I think the important thing to monitor via a threshold (or a filtered display) would be the listener the underlying process or service has created. As long as that's available and listening, I'd assume it's available to serve any inbound connection requests.

Hope this helps!

Regards,

Scott Clement